CrowdStrike says Glassworm operators used stolen developer credentials to force-push malicious code into the default branches of more than 300 GitHub repositories. The credentials came from earlier infections delivered through developer extensions and packages.
CrowdStrike, Google and the Shadowserver Foundation disrupted the botnet on May 26 at 14:00 UTC. The operation targeted four command-and-control channels at once. CrowdStrike said the coordinated action cut infected systems off from new instructions and payloads, but the takedown does not undo repository changes or revoke credentials already taken from a developer machine.
The campaign moved through normal developer workflows
Glassworm placed trojanized extensions in the OpenVSX marketplace, where they appeared to be ordinary tools such as time trackers and code formatters. The extensions could run in VS Code and several related editors. Compromised npm and Python packages supplied another route, using postinstall hooks and setup scripts to execute during dependency installation.
The malware ran on Windows, macOS and Linux. CrowdStrike attributed credential theft, information collection and a Node.js remote access tool called GlasswormRAT to the campaign. Stolen credentials then gave the operators a way back into the supply chain. They used GitHub access to alter default branches, which put malicious code in a location that developers and build systems routinely trust.
The shift from infected workstation to poisoned repository is the part an endpoint-only response can miss. Cleaning the host does not reveal which tokens were copied, which repositories were opened or whether a release was built from altered source.
Four C2 channels kept the botnet reachable
Glassworm resolved its command infrastructure through four different systems. Solana transaction memos carried server addresses. The BitTorrent Distributed Hash Table stored configuration data against hardcoded public keys. Google Calendar event titles held Base64-encoded C2 paths. Commercial virtual servers delivered the final payloads.
Those channels did different jobs, but each gave infected hosts another route toward the operator’s infrastructure. Removing one path would have left the others available. CrowdStrike said all four had to be disrupted at the same time to prevent the operators from reconstituting control.
The design also complicates ordinary network detection. A calendar service and a peer-to-peer network do not look like interchangeable C2 infrastructure when teams review them separately. On the infected host, however, the sequence of resolution activity can reveal their shared purpose. Endpoint telemetry should connect the extension or package process to later blockchain, DHT, calendar and VPS traffic.
The takedown created a useful infection signal
CrowdStrike now controls the IP address 164.92.88[.]210, and infected Glassworm systems beacon to it. The company says a connection to that address indicates infection and published YARA rules for GlasswormRAT and a Python downloader.
That indicator is valuable because the destination is now benign and specific to the disrupted botnet. A match should still open a broader investigation. The machine may have held GitHub sessions, package-registry tokens, SSH keys, cloud credentials or CI/CD access before the operator lost control.
Start with the credential inventory for the affected developer. Revoke active sessions and tokens rather than relying on a password reset. Review OAuth grants, SSH keys and package-publishing credentials. If a token’s use cannot be reconstructed, treat it as exposed.
Repository review should cover force-push events, default-branch history, workflow-file changes and commits made with the developer’s identity. Compare release artifacts with known source and inspect package publication history for the period in which the host may have been infected. Downstream builds need attention when altered source reached a shared branch or registry.
Developer tooling belongs in endpoint policy
Extensions and install scripts execute with the developer’s local access, yet many organizations cannot list which extensions are installed across managed engineering machines. That gap makes both prevention and scoping harder.
An extension inventory should record publisher, source marketplace, version and install time. Package installation events should retain the parent process and any network or credential access that follows. Developers who can publish packages or alter protected branches need shorter-lived credentials and controls that make a stolen session less useful.
Glassworm used software distribution to reach developers, then used developer authority to tamper with software distribution. The response has to follow the same route. Confirm the host infection, revoke the attached authority and inspect every repository or registry that authority could change.